Tag: cornflake.v3

1 Attack Reports | 0 Vulnerabilities

Attack reports

A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor

This analysis details a campaign involving two threat groups, UNC5518 and UNC5774, deploying the CORNFLAKE.V3 backdoor. UNC5518 compromises legitimate websites to serve fake CAPTCHA pages, luring visitors to execute a downloader script. UNC5774 then uses this access to deploy CORNFLAKE.V3, a sophis…
backdoor
node.js
clickfix
php
2025-08-21
cornflake.v3
windytwist.sea
kerberoasting
Published: August 21, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports